Overview

overview

10

Static

static

10

f62fef6f3a...c5.exe

windows7_x64

10

f62fef6f3a...c5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f62fef6f3a75f53fe3ce65440f750765635b2e9398a1e486e375c2da2a78d3c5

  • Size

    1.5MB

  • Sample

    220206-jd756agfek

  • MD5

    997d9a0c210f31ec90f157e77dc9c488

  • SHA1

    c10e62bf47b425970075a5c6d644db23cd93e08b

  • SHA256

    f62fef6f3a75f53fe3ce65440f750765635b2e9398a1e486e375c2da2a78d3c5

  • SHA512

    1936aeb4fc7919e9b070be3547c4c9ebbe8bd4390628abd8700bfa196e4dcfb040a3bb394c350827132f4f5d3ee60cedcde7f0754753a0a6c42fb27df3689cef

Score
10/10
neshtaevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      f62fef6f3a75f53fe3ce65440f750765635b2e9398a1e486e375c2da2a78d3c5

    • Size

      1.5MB

    • MD5

      997d9a0c210f31ec90f157e77dc9c488

    • SHA1

      c10e62bf47b425970075a5c6d644db23cd93e08b

    • SHA256

      f62fef6f3a75f53fe3ce65440f750765635b2e9398a1e486e375c2da2a78d3c5

    • SHA512

      1936aeb4fc7919e9b070be3547c4c9ebbe8bd4390628abd8700bfa196e4dcfb040a3bb394c350827132f4f5d3ee60cedcde7f0754753a0a6c42fb27df3689cef

    Score
    10/10
    neshtaevasionpersistencespywarestealertrojan

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks